Download

28 Chapter 2 • Botnets Overviewthat you don’t normally use, a host-based firewall can protect you against this attack vector.However, if it is a protocol that you must keep open you will need intrusion detection/protectioncapabilities. Unfortunately there is usually a lag of some time from when the patchcomes out until the intrusion detection/protection updates are released.Your antivirus softwaremay be able to detect the exploit after it happens, if it detects the code before the codehides from the A/V tool or worse, turns it off.Vulnerabilities Commonly Exploited by Bots:Agobot spreads via several methods including:■ Remote Procedure Call (RPC) Distributed Component Object Model (DCOM)(TCP ports 135, 139, 445, 593, and others) to XP systems■ RPC Locator vulnerability■ File shares on port 445■ If the target is a Web server, the IIS5 WEBDAV (Port 80) vulnerabilitySDBot Spreads through the following exploits:■ NetBios (port 139)■ NTPass (port 445)■ DCom (ports 135, 1025)■ DCom2 (port 135)■ MS RPC service and Windows Messenger port (TCP 1025)■ ASN.1 vulnerability, affects Kerberos (UDP 88) , LSASS.exe and Crypt32.dll (TCPports 135, 139, 445), and IIS Server using SSL■ UPNP (port 5000)■ Server application vulnerabilities■ WebDav (port 80)■ MSSQL (port 1433)■ Third-party application vulnerabilities such as DameWare remote managementsoftware (port 6129) or Imail IMAPD Login username vulnerability (port 143)■ A CISCO router vulnerability such as CISCO IOS HTTP authorization (Port 80)vulnerabilityIRCBot, Botzori, Zotob, Esbot, a version of Bobax, and a version of Spybot attempt tospread by exploiting the Microsoft Plug and Play vulnerability (MS 05-039).